There are many areas such as road traffic, production processes, the environment, and others in that sensors such as cameras, microphones, fire detectors or the like are used for monitoring and security surveillance.
The sensors detect events in relation to objects, such as vehicles passing certain spots, persons using public transportation, calls to emergency phone numbers, etc. The data that represents the events can have different forms, such as data files with photos (of the vehicles or persons) or video sequences, data blocks, etc. There is usually a limited amount of data per event that can be related to the event.
Due to a high number of events, 1000, or 1.0000.000 or much more events per second, the event data can only be processed by computers. Especially helpful are computers that perform complex event processing to recognize event patterns or complex events, recurring and expected activities by objects, and—potentially of more interest for security reasons—unexpected activities and deviations from rules.
For example, for vehicles that move along a standard trajectory passing a number of spots, the traffic density can be calculated and traffic congestions can be anticipated. In case a vehicle moves around some areas at unusual times, for example moves around a sports stadium at night, such a pattern should be reported immediately to police for taking precautionary action.
Looking at the data from the sensors, it can be temporarily or permanently stored in databases so that queries can identify the patterns; for real-time pattern recognition it is more suitable to process data-streams immediately.
However, real-time pattern recognition from data-streams is not free of technical constraints; it requires computer resources, such as processors or CPUs and memory resources to be scalable and protected against overload.
There are techniques available to adapt or re-write data queries for use with data-streams, for example, by reducing the number of operators in a query. But once queries are instantiated, the instances load the mentioned resources for a period of time until events are recognized or until the recognition of events becomes no longer possible.